fix(backend): decode cookie values after parsing

[brkalow]

Summary

• parse cookie boundaries before percent-decoding values
• preserve malformed percent-encoded values instead of throwing
• add regression coverage for malformed and lowercase encodings
• include an @clerk/backend patch changeset

Why

ClerkRequest decoded the complete Cookie header before parsing it. A malformed escape could throw during request construction, while encoded ; and = characters could be reinterpreted as cookie boundaries. The cookie dependency already decodes each isolated value safely and returns the raw value when decoding fails.

Fixes #9333.

[changeset-bot]

🦋 Changeset detected

Latest commit: 9c7267e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages

Name	Type
@clerk/backend	Patch
@clerk/astro	Patch
@clerk/express	Patch
@clerk/fastify	Patch
@clerk/hono	Patch
@clerk/nextjs	Patch
@clerk/nuxt	Patch
@clerk/react-router	Patch
@clerk/tanstack-react-start	Patch
@clerk/testing	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
clerk-js-sandbox	Ready	Preview	Aug 11, 2026 7:18pm
swingset	Ready	Preview	Aug 11, 2026 7:18pm

[pkg-pr-new]

Open in StackBlitz

@clerk/astro

npm i https://pkg.pr.new/@clerk/astro@9399

@clerk/backend

npm i https://pkg.pr.new/@clerk/backend@9399

@clerk/chrome-extension

npm i https://pkg.pr.new/@clerk/chrome-extension@9399

@clerk/clerk-js

npm i https://pkg.pr.new/@clerk/clerk-js@9399

@clerk/electron

npm i https://pkg.pr.new/@clerk/electron@9399

@clerk/electron-passkeys

npm i https://pkg.pr.new/@clerk/electron-passkeys@9399

@clerk/eslint-plugin

npm i https://pkg.pr.new/@clerk/eslint-plugin@9399

@clerk/expo

npm i https://pkg.pr.new/@clerk/expo@9399

@clerk/expo-google-signin

npm i https://pkg.pr.new/@clerk/expo-google-signin@9399

@clerk/expo-passkeys

npm i https://pkg.pr.new/@clerk/expo-passkeys@9399

@clerk/express

npm i https://pkg.pr.new/@clerk/express@9399

@clerk/fastify

npm i https://pkg.pr.new/@clerk/fastify@9399

@clerk/hono

npm i https://pkg.pr.new/@clerk/hono@9399

@clerk/localizations

npm i https://pkg.pr.new/@clerk/localizations@9399

@clerk/nextjs

npm i https://pkg.pr.new/@clerk/nextjs@9399

@clerk/nuxt

npm i https://pkg.pr.new/@clerk/nuxt@9399

@clerk/react

npm i https://pkg.pr.new/@clerk/react@9399

@clerk/react-router

npm i https://pkg.pr.new/@clerk/react-router@9399

@clerk/shared

npm i https://pkg.pr.new/@clerk/shared@9399

@clerk/tanstack-react-start

npm i https://pkg.pr.new/@clerk/tanstack-react-start@9399

@clerk/testing

npm i https://pkg.pr.new/@clerk/testing@9399

@clerk/ui

npm i https://pkg.pr.new/@clerk/ui@9399

@clerk/upgrade

npm i https://pkg.pr.new/@clerk/upgrade@9399

@clerk/vue

npm i https://pkg.pr.new/@clerk/vue@9399

commit: 9c7267e

[github-actions]

API Changes Report

Generated by Break Check on 2026-08-11T19:35:19.803Z

Summary

Metric	Count
Packages analyzed	19
Packages with changes	0
🔴 Breaking changes	0
🟡 Non-breaking changes	0
🟢 Additions	0

No API Changes Detected

All packages have stable APIs with no detected changes.

---

Report generated by Break Check

_{Last ran on 9c7267e.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 49173743-cf8b-43cb-ad69-768fb3e66d92

📥 Commits

Reviewing files that changed from the base of the PR and between 3132d40 and 9c7267e.

📒 Files selected for processing (3)

• .changeset/tidy-cookies-smile.md
• packages/backend/src/tokens/__tests__/clerkRequest.test.ts
• packages/backend/src/tokens/clerkRequest.ts

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• clerk/clerk_go (manual)
• clerk/dashboard (manual)
• clerk/accounts (manual)
• clerk/backoffice (manual)
• clerk/clerk (manual)
• clerk/clerk-docs (manual)
• clerk/cloudflare-workers (manual)
• clerk/cli (auto-detected)
• clerk/clerk-ios (auto-detected)
• clerk/clerk-android (auto-detected)

---

📝 Walkthrough

Walkthrough

The request cookie parser now passes the raw Cookie header to parse and removes the prior whole-header decoding helper. Tests cover encoded spaces, semicolons, equals signs, malformed percent encodings, continued parsing of neighboring cookies, and lowercase escapes. A patch changeset documents the updated @clerk/backend behavior.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• clerk/javascript#9345: Modifies the same cookie parsing implementation and related tests.

Suggested reviewers: jacekradko

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: decoding cookie values after cookie parsing.
Description check	✅ Passed	The description directly explains the cookie parsing fix, its rationale, regression coverage, and linked issue.
Linked Issues check	✅ Passed	The changes address issue #9333 by preventing malformed values from throwing and decoding values after parsing boundaries.
Out of Scope Changes check	✅ Passed	The changes are limited to cookie parsing behavior, regression tests, and the required backend patch changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

---

_{Comment @coderabbitai help to get the list of available commands.}